CVE-2026-6341 — Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0

title: CVE-2026-6341 - Mattermost API Direct Request to Locked Group
id: scw-2026-05-18-ai-1
status: experimental
level: medium
description: |
  This rule detects direct API requests to create posts within a Mattermost group, specifically targeting the '/api/v4/posts' endpoint. The vulnerability CVE-2026-6341 allows authenticated users to bypass group restrictions and create issues or comments in locked groups via direct API calls. This detection focuses on the API endpoint commonly used for posting and assumes a parameter like 'group_id' might be present in such a malicious request, allowing an attacker to target a specific group, potentially a locked one.
author: SCW Feed Engine (AI-generated)
date: 2026-05-18
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6341/
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v4/posts'
      cs-method|exact:
          - 'POST'
      cs-uri-query|contains:
          - 'group_id=' # This is a hypothetical parameter that might be used in a direct API call to a group
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse